CVE-2025-67725

Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same header name is repeated, causing a Denial of Service (DoS). Due to Python string immutability, each concatenation copies the entire string, resulting in O(n²) time complexity. The severity can vary from high if max_header_size has been increased from its default, to low if it has its default value of 64KB. This issue is fixed in version 6.5.3.

• CWE-400

• https://github.com/tornadoweb/tornado/commit/771472cfdaeebc0d89a9cc46e249f8891a6b29cdPatch
• https://github.com/tornadoweb/tornado/releases/tag/v6.5.3Release Notes
• https://github.com/tornadoweb/tornado/security/advisories/GHSA-c98p-7wgm-6p64Vendor Advisory

Published

Dec 12, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-6772A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2…7.5
• CVE-2025-67720Pyrofork is a modern, asynchronous MTProto API framework. Ve…6.5
• CVE-2025-67721Aircompressor is a library with ports of the Snappy, LZO, LZ…7.5
• CVE-2025-67722FreePBX is an open-source web-based graphical user interface…7.8
• CVE-2025-67723Discourse is an open source discussion platform. Versions pr…5.4
• CVE-2025-67724Tornado is a Python web framework and asynchronous networkin…6.1
• CVE-2025-67726Tornado is a Python web framework and asynchronous networkin…7.5
• CVE-2025-67727Parse Server is an open source backend that can be deployed …9.8
• CVE-2025-67728Fireshare facilitates self-hosted media and link sharing. Ve…9.8
• CVE-2025-67729LMDeploy is a toolkit for compressing, deploying, and servin…8.8
• CVE-2025-6773A vulnerability was found in HKUDS LightRAG up to 1.3.8. It …5.3
• CVE-2025-67730Frappe Learning Management System (LMS) is a learning system…5.4